1. Executive summary
A local file inclusion (LFI) flaw in the esm.sh service URL handling lets an unauthenticated, remote attacker craft a request that makes the server read and return files from the host filesystem. The GitHub Advisory Database rates it High at CVSS v4 7.7 (network, low complexity, no privileges, no user interaction, high confidentiality impact, no integrity or availability impact). No CVE has been assigned and the advisory records no fixed version, so there is no patch to point clients at. The exposure is to any organisation running the esm.sh server component, including self-hosted instances used as an internal JavaScript module CDN or build dependency; a successful read of environment files, configuration or private keys on such a host can hand an attacker the credentials that protect the surrounding estate. The advisory text is thin on mechanism and the reproduction detail is a developer's local run command, not a confirmed production exploit.
2. Regulatory framing
No specific DORA/NIS2 article is directly engaged by this item.
3. Technical analysis & attack chain
The advisory describes a path traversal in how the esm.sh service handles request URLs. The product takes external input to build a pathname that should stay inside a restricted directory but does not neutralise .. sequences, so a crafted request resolves outside that directory and the server returns the target file. The advisory gives no request syntax, no affected version range, no vulnerable function name and no fix commit. What follows is limited to what the source states.
- The attacker sends a request to the esm.sh service whose URL contains traversal sequences (
..) that resolve outside the intended directory. - The server builds a filesystem path from that input without neutralising the sequences.
- The server reads the resolved file and returns its contents in the response.
- The attacker receives whatever the service process can read: configuration files, environment files, private keys or other secrets, per the advisory's stated impact.
The advisory's own reproduction is a developer running the server locally with go run server/esmd/main.go --config=config.json, which starts it at http://localhost:9999. That establishes the server is the Go component under server/esmd and that it reads a JSON config file, but it is a local test harness, not a confirmed remote exploit against a production deployment. The advisory does not say which URL paths or parameters are affected, so a defender cannot scope exposure from the text alone.
Impact is read-only. The CVSS v4 vector records high confidentiality impact with integrity and availability both none, and no subsequent-system impact. The realistic consequence is disclosure of secrets that enable a second stage: credentials, API keys or signing material read from the host can be reused against other systems. The advisory does not describe any code execution, write or persistence primitive, and none should be assumed.
The advisory carries no CVE identifier, no CWE is stated in the supplied text beyond the MITRE description of path traversal, and no EPSS score or CISA KEV entry exists because no CVE is assigned. There is no attribution to any actor and no evidence of exploitation in the wild in the source. Treat any claim of active exploitation as unsupported.
4. Mitigation & containment
P1 (within 24h)
- Inventory every deployment of the esm.sh server component, including internal mirrors, build-cache services and developer instances reachable beyond localhost. The advisory names the Go entrypoint
server/esmd/main.go; use that to identify running instances. - Where an instance is internet-facing or holds secrets in its environment, restrict access at the network layer to known consumers until a fix is available. There is no vendor patch in the advisory, so exposure reduction is the only control the source supports.
- Rotate any credentials, API keys or private keys present in the environment or config of an exposed instance. The advisory's stated impact is disclosure of exactly these files, and rotation is the only way to invalidate a read that may already have happened.
P2 (within 72h)
- Review web server and application logs for requests to the esm.sh service containing
..traversal sequences or encoded variants, and for responses returning file contents outside expected asset paths. The advisory gives no exact payload, so hunt on the traversal pattern rather than a fixed string. - Run the service with the least filesystem privilege it can operate under, and keep its config file and environment out of directories the process can read beyond what it needs.
P3 (within 7 days)
- Track the GitHub advisory (GHSA-49pv-gwxp-532r) for a fixed version or commit. The advisory records no patched version as of its last update, so pinning to a known version is not yet possible; monitor and apply the fix when published.
- If esm.sh is consumed only as a hosted third-party CDN rather than self-hosted, confirm with the provider whether the hosted service was affected and what remediation they applied. The advisory does not state whether the public esm.sh service was impacted.
5. Indicators of compromise
No indicators of compromise available in the source material. The advisory gives no file hashes, domains, IP addresses, request strings or filenames. The only observable behaviour it implies is a request to the esm.sh service containing .. traversal sequences that returns file contents from outside the intended directory; that is a behavioural signal for log hunting, not an atomic indicator, and no atomic set exists to publish.
6. Detection
Insufficient indicators to author detection rules. The source provides no distinctive strings, command-line flags, filenames, registry keys or hard-coded values belonging to an exploit. The only artefacts are the product's own entrypoint path and config filename, which are legitimate components of the software and would match benign deployments, so a rule built on them would detect the product rather than an attack.
7. Sources
- GitHub Advisory Database, "esm.sh has File Inclusion issue" (GHSA-49pv-gwxp-532r), published 2025-09-17, last updated 2026-10-29. https://github.com/advisories/GHSA-49pv-gwxp-532r
8. Adverse Trace position
Adverse Trace assesses this as a High-severity (CVSS v4 7.7) information-disclosure flaw with a narrow blast radius: it matters to organisations that self-host the esm.sh server component, and it is low relevance to those that only consume the public CDN. The absence of a CVE, a fixed version and any exploitation reporting means we cannot confirm active targeting, and we will not characterise it as exploited. The advisory is single-sourced to the GitHub Advisory Database with no independent technical write-up, so the mechanism and any production exploit path are unconfirmed; verify before acting on the reproduction detail. We will monitor GHSA-49pv-gwxp-532r for a patched version and a CVE assignment, and update this note if either appears. Clients running self-hosted esm.sh instances should treat credential rotation on any exposed host as the priority action now, ahead of a patch that does not yet exist.
Published via PulseTrace — Adverse Trace threat intelligence.